Back 
COVID-19 contact tracing and personal cloud apps, what could possibly go wrong? A recent federal lawsuit, filed against the state of Pennsylvania and a vendor contracted by the state’s Department of Health, provides an interesting answer. The vendor in question was contracted “to provide contact tracing and other similar services” following the outbreak of COVID-19 in March 2020. Despite the good intentions, it ended up that the names, phone numbers, and medical information belonging to 72,000 individuals were exposed as a “direct result of the failure to implement adequate and reasonable cybersecurity procedures and protocols.”
No, a sophisticated hack, possibly by an overseas state-sponsored actor, is not implied in this case. The reality is much simpler, and potentially even more dangerous. This exposure is yet another consequence of the common habit of using personal apps to handle sensitive data without considering the security implications (“I have always done it this way”